elastic-stack.yml

version: '3.4'
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:6.7.0
    environment:
      - cluster.name=docker-cluster
      - bootstrap.memory_lock=false
      - node.name={{.Node.Hostname}}
      - ES_JAVA_OPTS=${ES_JAVA_OPTS:- -Xms512m -Xmx512m}
      - ELASTIC_PASSWORD=${ELASTICSEARCH_PASSWORD:-changeme}
      - xpack.security.enabled=true
      - xpack.monitoring.collection.enabled=true
      - xpack.license.self_generated.type=trial
      - http.host=0.0.0.0
      - discovery.zen.minimum_master_nodes=${ES_MASTER_NODES:-2}
    configs:
      - source: elastic_config
        target: /usr/share/elasticsearch/config/elasticsearch.yml
    ports:
      - target: 9200
        published: 9200
        mode: host
    networks:
      - es-net
    volumes:
      - es-data:/usr/share/elasticsearch/data
    deploy:
      endpoint_mode: dnsrr
      mode: global # Will be deployed to all nodes that match constraint, once per node


  kibana:
    image: docker.elastic.co/kibana/kibana:6.7.0
    environment:
      - transport.host=0.0.0.0
      - ELASTICSEARCH_URL="http://elasticsearch:9200"
      - ELASTICSEARCH_USERNAME=${ELASTICSEARCH_USERNAME:-elastic}
      - ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_PASSWORD:-changeme}
      - SERVER_NAME="{{.Node.Hostname}}-kibana"
    networks:
      - es-net
    ports:
      - 5601:5601
    depends_on:
      - elasticsearch
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints: [node.role == manager]

  logstash:
    image: docker.elastic.co/logstash/logstash:${ELASTIC_VERSION:-6.7.0}
    ports:
      - target: 5000
        published: 5000
        mode: host
    environment:
      - GN_KEY=${GN_KEY:-""}
      - LS_JAVA_OPTS=${ES_JAVA_OPTS:- -Xms512m -Xmx512m}
      - XPACK_MONITORING_ELASTICSEARCH_USERNAME=${ELASTICSEARCH_USERNAME:-elastic}
      - XPACK_MONITORING_ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_PASSWORD:-changeme}
      - ELASTICSEARCH_USERNAME=${ELASTICSEARCH_USERNAME:-elastic}
      - ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_PASSWORD:-changeme}
    networks:
      - es-net
    configs:
      - source: logstash_config
        target: /usr/share/logstash/pipeline/logstash.conf
      - source: logastah_es_template
        target: /usr/share/logstash/elasticsearch6-template.json
      - source: logstash_suricata
        target: /usr/share/logstash/pipeline/suricata.conf
      - source: logstash_beats_system_filter
        target: /usr/share/logstash/pipeline/beats-system-filter.conf
      - source: logstash_beats_nginx_filter
        target: /usr/share/logstash/pipeline/beats-nginx-filter.conf
      - source: logstash_elasticsearch_output
        target: /usr/share/logstash/pipeline/elasticsearch-output.conf
      - source: logstash_inputs
        target: /usr/share/logstash/pipeline/inputs.conf
      - source: logstash_ip_filter
        target: /usr/share/logstash/pipeline/ip-filter.conf
    command: bash -c " logstash-plugin install logstash-filter-greynoise && logstash --config.reload.automatic "
    depends_on:
      - elasticsearch
    deploy:
      endpoint_mode: dnsrr
      mode: global # Will be deployed to all nodes that match constraint, once per node
#      placement:
#        constraints: [node.hostname !=  manager-1]


  filebeat:
    image: docker.elastic.co/beats/filebeat:${ELK_VERSION:-6.6.1}
    command: ["--strict.perms=false"]
    user: root
    configs:
      - source: filebeat_config
        target: /usr/share/filebeat/filebeat.yml
    volumes:
      - /var/log:/var/log:ro
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/lib/docker/volumes/:/var/lib/docker/volumes/:ro    # read docker volumes i.e suricata
    environment:
      - ELASTICSEARCH_HOST=${ELASTICSEARCH_HOST:-elasticsearch:9200}
      - LOGSTASH_HOST=${LOGSTASH_HOST:-logstash:5044}
      - KIBANA_HOST=${KIBANA_HOST:-kibana:5601}
      - ELASTICSEARCH_USERNAME=${ELASTICSEARCH_USERNAME:-elastic}
      - ELASTICSEARCH_PASSWORD=${ELASTICSEARCH_PASSWORD:-changeme}
    networks:
      - es-net
    depends_on:
      - logstash
    deploy:
      mode: global


configs:

  elastic_config:
    file: ./elasticsearch/elasticsearch.yml
  logstash_config:
    file: ./logstash/pipeline/logstash.conf
  logastah_es_template:
    file: ./logstash/elasticsearch6-template.json
  logstash_suricata:
    file: ./logstash/pipeline/suricata.conf
  logstash_beats_system_filter:
    file: ./logstash/pipeline/beats-system-filter.conf
  logstash_beats_nginx_filter:
    file: ./logstash/pipeline/beats-nginx-filter.conf
  logstash_elasticsearch_output:
    file: ./logstash/pipeline/elasticsearch-output.conf
  logstash_inputs:
    file: ./logstash/pipeline/inputs.conf
  logstash_ip_filter:
    file: ./logstash/pipeline/ip-filter.conf
  filebeat_config:
    file: ./filebeat/config/filebeat.docker.yml
  suricata_config:
    file: ./suricata/suricata.yaml


volumes:
  es-data:



networks:
  es-net:
    attachable: true